Risk Leaderboard

348 open-source repositories ranked by activity-weighted risk — complexity × recent commit frequency. Higher scores mean more urgent refactoring priority.

Repositories 348
Avg Risk Score 18.3
Languages 13
Last Updated 2026-10-24
# Repository Risk
1 mudler/LocalAI 42.3
2 DioxusLabs/dioxus 41.1
3 nushell/nushell 37.1
4 cypress-io/cypress 29.4
5 HeyPuter/puter 28.1
6 eslint/eslint 26.8
7 rust-lang/cargo 26.6
8 prettier/prettier 26.1
9 astral-sh/ruff 26.0
10 facebook/react 25.4
11 BerriAI/litellm 24.8
12 odoo/odoo 24.8
13 appsmithorg/appsmith 24.4
14 prometheus/prometheus 23.1
15 safishamsi/graphify 22.5
16 calcom/cal.com 22.4
17 jax-ml/jax 22.4
18 fanmingming/live 22.2
19 pandas-dev/pandas 22.1
20 photoprism/photoprism 21.8
21 jinzhu/copier 21.7
22 vuejs/vue 21.7
23 vercel-labs/agent-browser 21.7
24 gsd-build/get-shit-done 21.7
25 CodePhiliaX/Chat2DB 21.7
26 sqlmapproject/sqlmap 21.6
27 usebruno/bruno 21.5
28 agno-agi/agno 21.4
29 lutzroeder/netron 21.4
30 ToolJet/ToolJet 21.4
31 chatboxai/chatbox 21.3
32 junegunn/fzf 21.3
33 colinhacks/zod 21.3
34 evanw/esbuild 21.2
35 novuhq/novu 21.2
36 juspay/hyperswitch 21.2
37 vllm-project/vllm 21.2
38 FlowiseAI/Flowise 21.2
39 koala73/worldmonitor 21.2
40 pola-rs/polars 21.2
41 nats-io/nats-server 21.2
42 exo-explore/exo 21.1
43 abhigyanpatwari/GitNexus 21.1
44 go-redis/redis 21.1
45 servo/servo 21.1
46 oobabooga/textgen 21.0
47 vitejs/vite 21.0
48 drawdb-io/drawdb 21.0
49 MHSanaei/3x-ui 21.0
50 NervJS/taro 21.0
51 rust-lang/rust-clippy 21.0
52 supabase/supabase 20.9
53 openssh/openssh-portable 20.9
54 mattermost/mattermost 20.9
55 Automattic/mongoose 20.8
56 grafana/k6 20.8
57 lib/pq 20.7
58 apache/airflow 20.7
59 getsentry/sentry 20.7
60 janhq/jan 20.7
61 deepspeedai/DeepSpeed 20.7
62 chakra-ui/chakra-ui 20.6
63 crewAIInc/crewAI 20.6
64 react-hook-form/react-hook-form 20.6
65 NanmiCoder/MediaCrawler 20.5
66 jestjs/jest 20.5
67 nwjs/nw.js 20.5
68 paperclipai/paperclip 20.5
69 moby/moby 20.4
70 borgbackup/borg 20.4
71 gogs/gogs 20.3
72 bevyengine/bevy 20.3
73 zhayujie/CowAgent 20.3
74 curl/curl 20.3
75 seaweedfs/seaweedfs 20.2
76 bokeh/bokeh 20.2
77 lovell/sharp 20.2
78 typeorm/typeorm 20.2
79 preactjs/preact 20.2
80 go-gorm/gorm 20.2
81 parallax/jsPDF 20.2
82 cockroachdb/cockroach 20.2
83 denoland/deno_std 20.2
84 jqlang/jq 20.2
85 rollup/rollup 20.2
86 dgraph-io/dgraph 20.2
87 denoland/deno 20.2
88 wailsapp/wails 20.2
89 cilium/cilium 20.2
90 portainer/portainer 20.1
91 apache/spark 20.1
92 huggingface/datasets 20.1
93 badlogic/pi-mono 20.1
94 GoogleChrome/lighthouse 20.1
95 virattt/ai-hedge-fund 20.0
96 mifi/lossless-cut 20.0
97 gradio-app/gradio 20.0
98 temporalio/temporal 19.9
99 mitmproxy/mitmproxy 19.9
100 swagger-api/swagger-ui 19.9
101 thedotmack/claude-mem 19.9
102 xuxueli/xxl-job 19.9
103 fish-shell/fish-shell 19.9
104 earendil-works/pi 19.9
105 streamlit/streamlit 19.8
106 XTLS/Xray-core 19.8
107 redisson/redisson 19.8
108 conductor-oss/conductor 19.8
109 ray-project/ray 19.8
110 expo/expo 19.8
111 astral-sh/uv 19.8
112 hashicorp/terraform 19.8
113 gethomepage/homepage 19.7
114 code-yeongyu/oh-my-openagent 19.7
115 harness/harness 19.7
116 rustfs/rustfs 19.7
117 SeaQL/sea-orm 19.7
118 CherryHQ/cherry-studio 19.7
119 ionic-team/ionic-framework 19.7
120 urfave/cli 19.6
121 HKUDS/nanobot 19.6
122 upstash/context7 19.6
123 garrytan/gstack 19.6
124 TanStack/table 19.6
125 go-playground/validator 19.5
126 pingcap/tidb 19.5
127 outline/outline 19.5
128 gchq/CyberChef 19.5
129 cli/cli 19.4
130 Fission-AI/OpenSpec 19.4
131 run-llama/llama_index 19.4
132 SimplifyJobs/Summer2026-Internships 19.4
133 wez/wezterm 19.4
134 bmad-code-org/BMAD-METHOD 19.4
135 666ghj/BettaFish 19.3
136 block/goose 19.3
137 phaserjs/phaser 19.3
138 tailscale/tailscale 19.3
139 hashicorp/packer 19.3
140 kubernetes/kubernetes 19.3
141 tldraw/tldraw 19.3
142 dandavison/delta 19.3
143 hashicorp/vault 19.2
144 bigskysoftware/htmx 19.2
145 pallets/jinja 19.2
146 remotion-dev/remotion 19.2
147 Aider-AI/aider 19.2
148 apache/rocketmq 19.2
149 hesreallyhim/awesome-claude-code 19.1
150 casey/just 19.1
151 serverless/serverless 19.1
152 twentyhq/twenty 19.0
153 AykutSarac/jsoncrack.com 19.0
154 ruvnet/RuView 19.0
155 elunez/eladmin 18.9
156 helix-editor/helix 18.9
157 vectordotdev/vector 18.8
158 meilisearch/meilisearch 18.8
159 surrealdb/surrealdb 18.8
160 Textualize/textual 18.8
161 hpcaitech/ColossalAI 18.8
162 gofiber/fiber 18.8
163 spacedriveapp/spacedrive 18.8
164 rust-lang/regex 18.8
165 typst/typst 18.7
166 remoteintech/remote-jobs 18.7
167 hashicorp/nomad 18.7
168 parcel-bundler/parcel 18.7
169 roboflow/supervision 18.7
170 alibaba/canal 18.7
171 Kong/insomnia 18.7
172 iced-rs/iced 18.6
173 v2ray/v2ray-core 18.6
174 grafana/loki 18.6
175 pixijs/pixijs 18.6
176 D4Vinci/Scrapling 18.6
177 jdx/mise 18.6
178 swaggo/swag 18.6
179 chenglou/pretext 18.5
180 makeplane/plane 18.5
181 docsifyjs/docsify 18.5
182 FuelLabs/fuels-rs 18.5
183 istio/istio 18.5
184 beetbox/beets 18.5
185 github/github-mcp-server 18.3
186 rust-lang/mdBook 18.3
187 paperless-ngx/paperless-ngx 18.3
188 celery/celery 18.2
189 1Panel-dev/1Panel 18.2
190 vuetifyjs/vuetify 18.2
191 locustio/locust 18.2
192 zen-browser/desktop 18.2
193 tiangolo/fastapi 18.2
194 influxdata/influxdb 18.1
195 pyca/cryptography 18.1
196 lapce/lapce 18.1
197 DavidHDev/react-bits 18.0
198 hyperium/hyper 18.0
199 clap-rs/clap 18.0
200 paramiko/paramiko 18.0
201 microsoft/qlib 18.0
202 fyne-io/fyne 18.0
203 jesseduffield/lazygit 17.9
204 opentofu/opentofu 17.9
205 ChromeDevTools/chrome-devtools-mcp 17.9
206 valyala/fasthttp 17.9
207 nolimits4web/swiper 17.9
208 PyCQA/pylint 17.8
209 AlistGo/alist 17.8
210 alibaba/zvec 17.8
211 v2fly/v2ray-core 17.8
212 markedjs/marked 17.8
213 apache/skywalking 17.7
214 meteor/meteor 17.7
215 tokio-rs/tracing 17.7
216 actix/actix-web 17.7
217 layui/layui 17.7
218 hashicorp/consul 17.6
219 minio/minio-go 17.6
220 vadimdemedes/ink 17.6
221 checkstyle/checkstyle 17.6
222 goharbor/harbor 17.5
223 pypa/pip 17.5
224 google/gson 17.4
225 containers/podman 17.4
226 juanfont/headscale 17.4
227 joblib/joblib 17.3
228 rust-lang/rustfmt 17.3
229 babysor/MockingBird 17.3
230 spf13/cobra 17.2
231 schollz/croc 17.2
232 linkerd/linkerd2 17.2
233 go-chi/chi 17.2
234 skylot/jadx 17.2
235 shareAI-lab/learn-claude-code 17.1
236 k3s-io/k3s 17.1
237 gin-gonic/gin 17.1
238 eclipse-vertx/vert.x 17.1
239 lyswhut/lx-music-desktop 17.0
240 validatorjs/validator.js 17.0
241 apache/log4j 16.9
242 google/langextract 16.9
243 danielmiessler/Fabric 16.9
244 nestjs/nest 16.9
245 trpc/trpc 16.9
246 slidevjs/slidev 16.9
247 encode/uvicorn 16.9
248 amruthpillai/reactive-resume 16.8
249 TanStack/query 16.8
250 dcloudio/uni-app 16.8
251 tw93/Pake 16.8
252 vercel/hyper 16.8
253 tower-rs/tower 16.7
254 wshobson/agents 16.7
255 google/wire 16.7
256 sqlalchemy/alembic 16.6
257 OpenCut-app/OpenCut 16.6
258 santifer/career-ops 16.6
259 watchexec/watchexec 16.5
260 XAMPPRocky/tokei 16.5
261 binarywang/WxJava 16.4
262 hexojs/hexo 16.4
263 sharkdp/hyperfine 16.3
264 nsqio/nsq 16.1
265 ueberdosis/tiptap 16.1
266 elysiajs/elysia 16.1
267 RSSNext/Folo 16.1
268 charmbracelet/glow 16.0
269 freqtrade/freqtrade 16.0
270 labstack/echo 16.0
271 restic/restic 16.0
272 charmbracelet/bubbletea 15.9
273 xyflow/xyflow 15.9
274 mybatis/mybatis-3 15.9
275 golang-migrate/migrate 15.8
276 lerna/lerna 15.8
277 2noise/ChatTTS 15.7
278 mitchellh/mapstructure 15.7
279 starship/starship 15.7
280 docker/compose 15.6
281 air-verse/air 15.6
282 streadway/amqp 15.5
283 umami-software/umami 15.5
284 tokio-rs/tokio 15.5
285 segmentio/kafka-go 15.5
286 alacritty/alacritty 15.5
287 styled-components/styled-components 15.4
288 immerjs/immer 15.4
289 rust-lang/rustlings 15.4
290 sahat/hackathon-starter 15.3
291 astral-sh/rye 15.3
292 encode/starlette 15.3
293 11ty/eleventy 15.3
294 filebrowser/filebrowser 15.2
295 vuejs/vitepress 15.2
296 redis/redis 15.1
297 brettwooldridge/HikariCP 15.0
298 jmoiron/sqlx 14.9
299 kubernetes/minikube 14.9
300 sunface/rust-course 14.9
301 rs/zerolog 14.9
302 GyulyVGC/sniffnet 14.8
303 Leaflet/Leaflet 14.8
304 google/comprehensive-rust 14.7
305 yarnpkg/yarn 14.7
306 sxyazi/yazi 14.6
307 koajs/koa 14.6
308 pugjs/pug 14.6
309 ajeetdsouza/zoxide 14.5
310 hyperium/tonic 14.4
311 google/zx 14.4
312 mitchellh/cli 14.4
313 sharkdp/fd 14.3
314 derailed/k9s 14.2
315 charmbracelet/lipgloss 14.2
316 gorilla/mux 14.2
317 eza-community/eza 14.1
318 rayon-rs/rayon 14.1
319 spf13/afero 14.1
320 jingyaogong/minimind 14.0
321 aquasecurity/trivy 14.0
322 videojs/video.js 14.0
323 sass/dart-sass 14.0
324 microsoft/monaco-editor 14.0
325 behave/behave 13.9
326 jesseduffield/lazydocker 13.9
327 uber-go/zap 13.6
328 tokio-rs/axum 13.6
329 naptha/tesseract.js 13.5
330 pcottle/learnGitBranching 13.1
331 PyCQA/flake8 13.1
332 chalk/chalk 12.8
333 google/uuid 12.8
334 iamkun/dayjs 12.7
335 natefinch/lumberjack 12.3
336 ant-design/ant-design-pro 12.1
337 dtolnay/anyhow 11.8
338 type-challenges/type-challenges 11.6
339 fastapi/full-stack-fastapi-template 10.6
340 upscayl/upscayl 9.9
341 sudheerj/javascript-interview-questions 9.0
342 boto/boto3 8.9
343 indiespirit/react-native-chart-kit 8.7
344 ktorio/ktor 8.7
345 sudheerj/reactjs-interview-questions 8.3
346 animate-css/animate.css 8.1
347 typescript-cheatsheets/react 4.8
348 vsavkin/large-monorepo 3.6

About the Risk Score

Each score is an activity-weighted risk metric: structural complexity (cyclomatic complexity × nesting depth × fan-out) multiplied by recent commit frequency. A function that is both highly complex and actively changing scores highest — it represents live regression risk, not just latent debt. Scores are not comparable across different versions of the same repo — use them to rank hotspots within a single analysis.

≥ 20 critical ≥ 10 high ≥ 5 medium < 5 low